@attalabs/vinaya 0.22.0 → 0.23.0

package/studio-standalone/_node_modules/@attalabs/aeg-core/src/reader-resolvable-prose.ts

@@ -0,0 +1,320 @@
+/**
+ * Reader-resolvable prose — classes 1 and 2 of the three-class analysis in
+ * Issue #694: the two mechanizable classes of "words a reader cannot
+ * resolve." Class 3 (register/slop — padding adjectives, first person,
+ * narrating the work episode) is NOT here; it stays with the review role,
+ * per the measurement below.
+ *
+ * **The measurement that disqualifies a phrase blacklist.** A phrase
+ * blacklist tested against the real corpus (all of `aeg-root` plus 1,157
+ * TypeScript files) scored 14 hits, 14 false positives, 0 true positives —
+ * "a review was *requested*"; "could *this change* leak a secret"; "*I have*
+ * X, Y, Z" inside a quoted example. The fix is not tuning the word list; it
+ * is asking a different question:
+ *
+ *   - Class 1 (references): not "does this phrase appear" but "does this
+ *     doctrine cite a forge number or tranche slug the reader has no forge to
+ *     resolve." Reuses the same two pattern shapes proven in
+ *     `retired-vocabulary.test.ts` (`FORGE_NUMBER_PATTERN`,
+ *     `TRANCHE_SLUG_VN_PATTERN`, and the legacy-slug list derived — not
+ *     guessed — from `aeg-root/tranches/completed/*.md` filenames), scoped to
+ *     the reader-facing surfaces instead of banned repo-wide (the same digit
+ *     shape is this product's own live `Closes #N`/PR-number grammar
+ *     elsewhere, so a repo-wide ban would flag the mechanism, not the
+ *     citation habit).
+ *   - Class 2 (vocabulary): not "is this word forbidden" but "does this
+ *     reader-facing file use a coined term while neither defining it inline
+ *     nor linking a definition." The term list is derived from
+ *     `aeg-root/glossary.md`'s own entry headings — never hard-coded — so it
+ *     cannot drift the first time an entry is added.
+ *
+ * Zero I/O: every input (file paths + contents, the glossary's term list, the
+ * legacy-slug list) is read by the adapter and passed in. POSIX-ERE-safe
+ * patterns only — no `\d`/`\w`/`\s`/lookaheads, and no `\b` relied on after a
+ * non-word character (the exact regression class `retired-vocabulary.test.ts`
+ * already paid for) — even though these patterns run through native
+ * `RegExp`, not `grep -E`, keeping them portable to either.
+ */
+
+export type ProseFileClass = 'ships' | 'reader-facing' | 'internal'
+
+export type ProseSourceFile = { path: string; content: string }
+
+export type ProseFinding = {
+  file: string
+  line: number
+  message: string
+}
+
+/**
+ * `aeg-root/**` by default — what this repo's own package carries and
+ * `/docs` publishes. Every caller below takes `shipsPrefix` as its LAST,
+ * defaulted parameter so an adopter whose installed doctrine tree lives
+ * somewhere else (task 7, Issue #56 — de-hardcoding `doctrineRoot`) can
+ * override it without breaking any existing positional call.
+ */
+const SHIPS_PREFIX = 'aeg-root/'
+
+/** `<shipsPrefix>tranches/completed/` — history, never rewritten. Same exemption `retired-vocabulary.test.ts` already carries for the identical reason: an archived tranche legitimately cites the forge numbers and slugs it closed. */
+function shipsArchivePrefix(shipsPrefix: string): string {
+  return `${shipsPrefix}tranches/completed/`
+}
+
+/** A per-product specs file (`apps/<product>/specs/**`) — this reader has this forge; references are legitimate here. */
+function isSpecFile(path: string): boolean {
+  return path.startsWith('apps/') && path.includes('/specs/') && path.endsWith('.md')
+}
+
+/** Any `CLAUDE.md`, at any depth — same reasoning as specs: this reader has this forge. */
+function isClaudeMdFile(path: string): boolean {
+  return path === 'CLAUDE.md' || path.endsWith('/CLAUDE.md')
+}
+
+/**
+ * The file-class map, encoded as data (not a rule buried in control flow).
+ * Returns `null` for anything outside all three classes — out of this
+ * check's scope entirely, not merely exempt.
+ *
+ * `readerFacingPrefix`/`readerFacingSuffix` scope the "reader-facing" class
+ * to a consumer's own reader-facing surface — this package stays generic and
+ * has no attalabs-specific path baked in. The caller-supplied shape mirrors
+ * the vinaya adopter's product site: a page's own body is where
+ * reader-visible prose lives (JSX text, step copy); sibling component
+ * directories include non-textual/decorative surfaces (e.g. canvas
+ * illustrations using fictional PR numbers as flavor text) that are not
+ * prose in the sense this check means, hence a suffix-scoped match rather
+ * than a bare prefix.
+ */
+export function classifyProseFile(
+  path: string,
+  readerFacingPrefix: string,
+  readerFacingSuffix: string,
+  shipsPrefix: string = SHIPS_PREFIX
+): ProseFileClass | null {
+  if (path.startsWith(shipsPrefix)) {
+    return path.startsWith(shipsArchivePrefix(shipsPrefix)) ? 'internal' : 'ships'
+  }
+  if (path.startsWith(readerFacingPrefix) && path.endsWith(readerFacingSuffix)) {
+    return 'reader-facing'
+  }
+  if (isSpecFile(path) || isClaudeMdFile(path)) return 'internal'
+  return null
+}
+
+/** The two classes this check actually sweeps — `internal` never is. */
+const SWEPT_CLASSES: ReadonlySet<ProseFileClass> = new Set(['ships', 'reader-facing'])
+
+/**
+ * Strips the parts of a file that are never reader prose, per file kind — a
+ * fenced/inline code example in a markdown doc, or a source comment in a
+ * `.tsx` page (a page's own developer-facing comments, e.g. "same reasoning
+ * as `/roadmap`", are not what a site visitor reads). Line count is
+ * preserved (replacements keep their newlines) so reported line numbers stay
+ * accurate against the original file.
+ *
+ * The `//` line-comment cut requires the marker not be immediately preceded
+ * by `:` — without that, `https://vinaya.dev` on a reader-facing line reads
+ * as a comment starting at its own `//`, silently blanking every word of
+ * real prose that follows it on the line. No boundary check is needed on
+ * the far side: unlike `//`, the character before it is never itself part
+ * of the marker, so a plain capturing group (not a lookbehind) is enough.
+ */
+export function stripNonProse(path: string, content: string): string {
+  if (path.endsWith('.md')) {
+    return content
+      .replace(/```.*?```/gs, (m) => m.replace(/[^\n]/g, ''))
+      .replace(/`[^`\n]*`/g, (m) => m.replace(/[^\n]/g, ''))
+  }
+  if (path.endsWith('.tsx') || path.endsWith('.ts')) {
+    return content
+      .replace(/\/\*.*?\*\//gs, (m) => m.replace(/[^\n]/g, ''))
+      .replace(/(^|[^:])\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, ''))
+  }
+  return content
+}
+
+function lineAt(content: string, index: number): number {
+  let line = 1
+  for (let i = 0; i < index; i++) {
+    if (content.charCodeAt(i) === 10) line++
+  }
+  return line
+}
+
+/** `#294`-shaped — a PR/Issue number cited bare, resolvable only inside this repo's own tracker. */
+export const FORGE_NUMBER_PATTERN = /#[0-9]{2,4}/g
+
+/** `aeg-forge-state-v1`-shaped — an internal tranche slug ending `-vN`. */
+export const TRANCHE_SLUG_VN_PATTERN = /[a-z][a-z-]+-v[0-9]/g
+
+/**
+ * Builds the legacy-slug pattern from the real archived-tranche filenames
+ * the adapter reads (mirrors `retired-vocabulary.test.ts`'s `legacySlugs()` —
+ * derived from `aeg-root/tranches/completed/*.md`, never a shape guess).
+ * Returns `null` when there is nothing left for it to catch (every archived
+ * slug now ends `-vN`), matching that file's "no pattern with zero positive
+ * samples" rule.
+ *
+ * Boundary-checked like `containsWholeWord` below (character class, not
+ * `\b`) so a real slug cannot match as a bare substring inside a longer,
+ * unrelated token. `retired-vocabulary.test.ts`'s own copy of this pattern
+ * has no such boundary; this one adds it rather than copying the gap.
+ * Group 1 is the leading boundary char (or start-of-string), group 2 is the
+ * slug itself, group 3 the trailing boundary char (or end-of-string) — the
+ * caller reports group 2, not the whole match, so the boundary chars never
+ * leak into a finding's message.
+ */
+export function legacySlugPattern(legacySlugs: readonly string[]): RegExp | null {
+  if (legacySlugs.length === 0) return null
+  const alternation = legacySlugs.map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|')
+  return new RegExp(`(^|[^a-zA-Z0-9\\n-])(${alternation})([^a-zA-Z0-9\\n-]|$)`, 'g')
+}
+
+/**
+ * Class 1 — unresolvable references. Runs the reference patterns over every
+ * swept file (`ships`/`reader-facing`), skipping code-fenced/commented-out
+ * non-prose first.
+ */
+export function checkUnresolvableReferences(
+  files: readonly ProseSourceFile[],
+  readerFacingPrefix: string,
+  readerFacingSuffix: string,
+  legacySlugs: readonly string[] = [],
+  shipsPrefix: string = SHIPS_PREFIX
+): ProseFinding[] {
+  const findings: ProseFinding[] = []
+  const legacyPattern = legacySlugPattern(legacySlugs)
+  // `group` names the capture holding the actual cited text — the plain
+  // patterns have none (report the whole match), the boundary-checked
+  // legacy-slug pattern reports its group 2 so the boundary chars around it
+  // never leak into the finding's message.
+  const patterns: { pattern: RegExp; what: string; group?: number }[] = [
+    { pattern: FORGE_NUMBER_PATTERN, what: 'a forge number' },
+    { pattern: TRANCHE_SLUG_VN_PATTERN, what: 'an internal tranche slug' },
+    ...(legacyPattern ? [{ pattern: legacyPattern, what: 'an internal tranche slug', group: 2 }] : [])
+  ]
+
+  for (const file of files) {
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix, shipsPrefix)
+    if (!cls || !SWEPT_CLASSES.has(cls)) continue
+    const scrubbed = stripNonProse(file.path, file.content)
+    for (const { pattern, what, group } of patterns) {
+      pattern.lastIndex = 0
+      let match: RegExpExecArray | null = pattern.exec(scrubbed)
+      while (match !== null) {
+        const cited = group !== undefined ? (match[group] ?? match[0]) : match[0]
+        findings.push({
+          file: file.path,
+          line: lineAt(scrubbed, match.index),
+          message: `references ${what} ("${cited}") a reader outside this repo's tracker cannot resolve`
+        })
+        match = pattern.exec(scrubbed)
+      }
+    }
+  }
+  return findings
+}
+
+/** Escapes a glossary term for use inside a hand-built, boundary-checked pattern. */
+function escapeTerm(term: string): string {
+  return term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+/**
+ * Whole-word (or whole-phrase), case-insensitive occurrence of `term` in
+ * `text` — boundaries checked by character class rather than `\b`, per the
+ * "do not rely on `\b` after a non-word character" lesson. Matches the exact
+ * glossary heading only (no inflections): "briefly" must never match
+ * "brief" the way a prefix match would — that exact shape (`let's` matching
+ * `bullet's`) is what the disqualifying measurement caught.
+ */
+function containsWholeWord(text: string, term: string): boolean {
+  const escaped = escapeTerm(term)
+  const re = new RegExp(`(^|[^a-zA-Z])${escaped}([^a-zA-Z]|$)`, 'i')
+  return re.test(text)
+}
+
+function findWholeWordLine(content: string, term: string): number | null {
+  const lines = content.split('\n')
+  let lineNo = 0
+  for (const line of lines) {
+    lineNo++
+    if (containsWholeWord(line, term)) return lineNo
+  }
+  return null
+}
+
+/**
+ * A file "defines" a term inline when it carries the same
+ * `Term — definition` shape the glossary itself uses (an em-dash right after
+ * the term), or links the glossary page/file directly.
+ */
+function definesOrLinksGlossary(content: string, term: string): boolean {
+  const escaped = escapeTerm(term)
+  const definesInline = new RegExp(`(^|[^a-zA-Z])${escaped}([^a-zA-Z]|$)[^\\n]{0,3}—`, 'i').test(content)
+  if (definesInline) return true
+  return /docs\/glossary|glossary\.md/i.test(content)
+}
+
+/**
+ * Class 2 — undefined coined vocabulary. Not "is this word forbidden" — it
+ * is "does this reader-facing file use a coined term while neither defining
+ * it inline nor linking a definition." `glossaryTerms` is read by the
+ * adapter from `aeg-root/glossary.md`'s own entry headings — never
+ * hard-coded here, so the check cannot silently rot the first time an entry
+ * is added.
+ */
+export function checkUndefinedVocabulary(
+  files: readonly ProseSourceFile[],
+  glossaryTerms: readonly string[],
+  readerFacingPrefix: string,
+  readerFacingSuffix: string,
+  shipsPrefix: string = SHIPS_PREFIX
+): ProseFinding[] {
+  const findings: ProseFinding[] = []
+
+  for (const file of files) {
+    const cls = classifyProseFile(file.path, readerFacingPrefix, readerFacingSuffix, shipsPrefix)
+    if (!cls || !SWEPT_CLASSES.has(cls)) continue
+    const scrubbed = stripNonProse(file.path, file.content)
+
+    for (const term of glossaryTerms) {
+      const line = findWholeWordLine(scrubbed, term)
+      if (line === null) continue
+      if (definesOrLinksGlossary(scrubbed, term)) continue
+      findings.push({
+        file: file.path,
+        line,
+        message: `uses coined term "${term}" without defining it inline or linking the glossary`
+      })
+    }
+  }
+  return findings
+}
+
+/** Runs both mechanizable classes over the given files in one pass. */
+export function checkReaderResolvableProse(
+  files: readonly ProseSourceFile[],
+  glossaryTerms: readonly string[],
+  readerFacingPrefix: string,
+  readerFacingSuffix: string,
+  legacySlugs: readonly string[] = [],
+  shipsPrefix: string = SHIPS_PREFIX
+): ProseFinding[] {
+  return [
+    ...checkUnresolvableReferences(files, readerFacingPrefix, readerFacingSuffix, legacySlugs, shipsPrefix),
+    ...checkUndefinedVocabulary(files, glossaryTerms, readerFacingPrefix, readerFacingSuffix, shipsPrefix)
+  ]
+}
+
+/** Parses `aeg-root/glossary.md`'s `**Term** — definition` entry headings into a bare term list. */
+export function parseGlossaryTerms(glossaryContent: string): string[] {
+  const terms: string[] = []
+  const re = /^\*\*(.+?)\*\* —/gm
+  let match: RegExpExecArray | null = re.exec(glossaryContent)
+  while (match !== null) {
+    if (match[1] !== undefined) terms.push(match[1])
+    match = re.exec(glossaryContent)
+  }
+  return terms
+}

package/studio-standalone/_node_modules/@attalabs/aeg-core/src/registry-checks.ts

@@ -0,0 +1,255 @@
+/**
+ * registry-checks.ts — G1–G6, the deterministic coherence checks that make
+ * `aeg-root/enforcement.md`'s three ring tables (parsed by
+ * `registry-parse.ts`) load-bearing instead of decorative.
+ *
+ * Pure — no `fs`, no `git`/`gh` I/O, no `fetch`. All forge/filesystem facts
+ * are injected by the caller (`bin/verify-registry.ts` /
+ * `apps/cli/src/checks/bin/check-registry-gates.ts`, the I/O shims),
+ * mirroring `coherence-checks.ts`'s shape exactly (plain executables,
+ * deterministic pass/fail, no config conditionals).
+ *
+ * Rollout policy: G2 ships report-only — it can only ever report `'info'`,
+ * never `'fail'`, so it never affects CI's exit code (the accepted shape for
+ * G2's inverse sweep, unchanged by task 8). G1 was report-only through its
+ * own rollout window; task 8 flips it to blocking now that the orphan
+ * backlog it existed to surface is clean (0 findings against the real
+ * `enforcement.md` at the time of the flip). G3–G6 are blocking (`'fail'` on
+ * any violation).
+ */
+
+import { GATE_AUDIENCE, isShipped } from './gate-audience'
+import type { GateRow } from './registry-parse'
+
+export type RegistryCheckStatus = 'pass' | 'fail' | 'info'
+
+export type RegistryFinding = {
+  row?: string
+  path?: string
+  reason: string
+}
+
+export type RegistryCheckResult = {
+  check: 'G1' | 'G2' | 'G3' | 'G4' | 'G5' | 'G6'
+  status: RegistryCheckStatus
+  findings: RegistryFinding[]
+}
+
+/**
+ * G1 — every row's non-empty `implementation` resolves on disk. Blocking as
+ * of task 8 (re-graded from report-only: eleven permanent `info` findings on
+ * every run had become indistinguishable from silence, which is how the gap
+ * this tranche closes stayed invisible; the report-only window had already
+ * cleared the backlog it existed to surface).
+ */
+export function checkG1(rows: GateRow[], existsFn: (path: string) => boolean): RegistryCheckResult {
+  const findings: RegistryFinding[] = []
+  for (const row of rows) {
+    if (row.implementation === '') continue
+    if (!existsFn(row.implementation)) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" names implementation "${row.implementation}", which does not exist on disk`
+      })
+    }
+  }
+  return { check: 'G1', status: findings.length > 0 ? 'fail' : 'pass', findings }
+}
+
+/** The literal placeholder marker a registry-scaffold stub row's
+ * non-mechanical cells carry (`registry-scaffold.ts`'s `PLACEHOLDER`,
+ * duplicated here rather than imported to keep this module's zero-import
+ * shape — the two are asserted equal by `registry-checks.test.ts`). A stub
+ * that filled `implementation` alone would silence G2 outright (the whole
+ * defect Issue #104 exists to close): this marker is what keeps a row G2
+ * still flags loud until a human replaces it with the real "why". */
+const SCAFFOLD_PLACEHOLDER = '[undocumented — fill in why]'
+
+/**
+ * G2 — every candidate hook/CLI file is named by SOME row's `implementation`,
+ * AND no row still carries the scaffold's placeholder marker un-replaced.
+ * `candidateFiles` is already-globbed by the caller (`.husky/*`,
+ * `.claude/hooks/*.sh`, `packages/aeg-core/bin/*.ts`, excluding `.husky/_`).
+ * Report-only this tranche — same as G1, never `'fail'`.
+ *
+ * The second half (placeholder scan) is what keeps a registry-scaffold stub
+ * row visible: `implementation` presence alone would make a stub read as
+ * "documented" to the ORPHAN half above, which is precisely the trap the
+ * scaffold must not fall into. Scanned over `summary`/`description`/`spec`
+ * — every cell a stub can carry the marker in — never `implementation`,
+ * `action`, `category`, or `audience`, which the scaffold fills mechanically
+ * and are never expected to carry it.
+ */
+export function checkG2(rows: GateRow[], candidateFiles: string[]): RegistryCheckResult {
+  const implementations = new Set(rows.map((r) => r.implementation).filter((p) => p !== ''))
+  const findings: RegistryFinding[] = []
+  for (const path of candidateFiles) {
+    if (!implementations.has(path)) {
+      findings.push({
+        path,
+        reason: `"${path}" is not named as the implementation of any row in enforcement.md's ring tables`
+      })
+    }
+  }
+  for (const row of rows) {
+    const carriesPlaceholder = [row.summary, row.description, row.spec].some((cell) => cell === SCAFFOLD_PLACEHOLDER)
+    if (carriesPlaceholder) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" still carries the scaffold placeholder marker — the why is owed`
+      })
+    }
+  }
+  return { check: 'G2', status: findings.length > 0 ? 'info' : 'pass', findings }
+}
+
+/**
+ * G3 — every file that makes a GitHub-crossing call is named by SOME Ring-0
+ * row's `implementation` — "no seventh way into GitHub". `crossingFiles` is
+ * already-detected by the caller via a source-grep. Blocking.
+ */
+export function checkG3(ring0Rows: GateRow[], crossingFiles: string[]): RegistryCheckResult {
+  const ring0Implementations = new Set(ring0Rows.map((r) => r.implementation))
+  const findings: RegistryFinding[] = []
+  for (const path of crossingFiles) {
+    if (!ring0Implementations.has(path)) {
+      findings.push({
+        path,
+        reason: `"${path}" makes a GitHub-crossing call but is not named by any Ring-0 row's implementation — a seventh, unlisted way into GitHub`
+      })
+    }
+  }
+  return { check: 'G3', status: findings.length > 0 ? 'fail' : 'pass', findings }
+}
+
+/**
+ * G4 — every `#NNN` cited in enforcement.md's body resolves in the forge.
+ * `resolveFn` wraps `gh issue view`/`gh pr view` (caller injects). Blocking.
+ * Broad reading (brief): every `#`-prefixed 3-or-more-digit number
+ * occurring anywhere in the body is checked, not just ones near keywords
+ * like "incident" — an incomplete keyword net would create a
+ * false-negative gap. The current repo's real citations are all 3-4
+ * digits; the lower bound of 3 exists only to exclude unrelated short
+ * numerals (ring/tier numbers) that are never written with a `#` prefix
+ * anyway — there is deliberately no upper bound, so a longer fabricated
+ * number is still caught.
+ */
+export function checkG4(content: string, resolveFn: (n: number) => boolean): RegistryCheckResult {
+  const cited = new Set<number>()
+  for (const hit of content.matchAll(/#(\d{3,})\b/g)) {
+    cited.add(Number(hit[1]))
+  }
+  const findings: RegistryFinding[] = []
+  for (const n of cited) {
+    if (!resolveFn(n)) {
+      findings.push({
+        reason: `#${n} is cited in enforcement.md but does not resolve to a real Issue or PR in the forge`
+      })
+    }
+  }
+  return { check: 'G4', status: findings.length > 0 ? 'fail' : 'pass', findings }
+}
+
+/**
+ * G5 — every contract's producer/consumer is a real role_id; every role's
+ * `performs`/`refuses_when` is present and non-empty. Blocking.
+ *
+ * "The action exists" is satisfied by presence/well-formedness of the
+ * role's own frontmatter — there is no second, independent registry of
+ * valid actions to cross-reference `performs` entries against.
+ */
+export function checkG5(
+  roles: Array<{ file: string; role_id: string; performs: string[]; refuses_when: string }>,
+  contracts: Array<{ file: string; producer: string; consumer: string }>
+): RegistryCheckResult {
+  const roleIds = new Set(roles.map((r) => r.role_id))
+  const findings: RegistryFinding[] = []
+
+  for (const contract of contracts) {
+    if (!roleIds.has(contract.producer)) {
+      findings.push({
+        path: contract.file,
+        reason: `contract "${contract.file}" names producer "${contract.producer}", which is not a real role_id`
+      })
+    }
+    if (!roleIds.has(contract.consumer)) {
+      findings.push({
+        path: contract.file,
+        reason: `contract "${contract.file}" names consumer "${contract.consumer}", which is not a real role_id`
+      })
+    }
+  }
+
+  for (const role of roles) {
+    if (role.performs.length === 0) {
+      findings.push({ path: role.file, reason: `role "${role.role_id}" has an empty performs array` })
+    }
+    if (role.refuses_when.trim() === '') {
+      findings.push({ path: role.file, reason: `role "${role.role_id}" has an empty refuses_when` })
+    }
+  }
+
+  return { check: 'G5', status: findings.length > 0 ? 'fail' : 'pass', findings }
+}
+
+const SHIPPED_BIN_PATH_PREFIX = 'apps/cli/src/checks/bin/check-'
+const AEG_CORE_BIN_PATH_PREFIX = 'packages/aeg-core/bin/'
+
+function basenameNoExt(path: string): string {
+  const base = path.slice(path.lastIndexOf('/') + 1)
+  return base.replace(/\.ts$/, '')
+}
+
+/**
+ * Every `coreCheckRegistry()` name a `product`-audience row's implementation
+ * could resolve to. Two shapes: a path directly under the shipped bin
+ * directory names its own check 1:1 (`apps/cli/src/checks/bin/check-doc-
+ * coverage-push.ts` -> `doc-coverage-push`); a path under
+ * `packages/aeg-core/bin/` resolves through `GATE_AUDIENCE`, the same map
+ * `shipped-bin-audience.test.ts` (`apps/cli`) already asserts agrees with
+ * the registry — reused here rather than re-derived, so doctrine and code
+ * cannot silently disagree about what a bin ships as. Neither shape matches
+ * (e.g. a `.github/workflows/*.yml` path, `checks/runner.ts`, a forge-write
+ * command) resolves to no candidate at all — correct, since those are not
+ * `coreCheckRegistry()` checks by construction.
+ */
+function claimedCheckNames(implementation: string): string[] {
+  if (implementation.startsWith(SHIPPED_BIN_PATH_PREFIX) && implementation.endsWith('.ts')) {
+    return [implementation.slice(SHIPPED_BIN_PATH_PREFIX.length, -'.ts'.length)]
+  }
+  if (implementation.startsWith(AEG_CORE_BIN_PATH_PREFIX)) {
+    const audience = GATE_AUDIENCE[basenameNoExt(implementation)]
+    if (audience && isShipped(audience)) {
+      return Array.isArray(audience.shippedAs) ? audience.shippedAs : [audience.shippedAs]
+    }
+  }
+  return []
+}
+
+/**
+ * G6 — every row doctrine marks `product` must actually resolve to a
+ * `coreCheckRegistry()` entry ("claimed checks must ship" — the parity gate
+ * this task exists for). `registeredCheckNames` is caller-injected
+ * (`coreCheckRegistry().map(s => s.name)`, from `apps/cli`, which
+ * `aeg-core` cannot import without closing a dependency cycle — same
+ * reasoning `gate-audience.ts` documents for `GATE_AUDIENCE` itself).
+ * Blocking. A row left at the default `repo-own` audience makes no shipped
+ * claim and is never checked here.
+ */
+export function checkG6(rows: GateRow[], registeredCheckNames: Set<string>): RegistryCheckResult {
+  const findings: RegistryFinding[] = []
+  for (const row of rows) {
+    if (row.audience !== 'product') continue
+    const candidates = claimedCheckNames(row.implementation)
+    if (!candidates.some((name) => registeredCheckNames.has(name))) {
+      findings.push({
+        row: row.action,
+        path: row.implementation,
+        reason: `${row.ring} row "${row.action}" is marked \`product\` but its implementation "${row.implementation}" does not resolve to a coreCheckRegistry() entry`
+      })
+    }
+  }
+  return { check: 'G6', status: findings.length > 0 ? 'fail' : 'pass', findings }
+}